When this test in run via restraint (e.g. on Beaker), it inherits some
file descriptors originating from it, labeled unconfined_service_t. This
leads to a huge amount of denials when test programs are exectuted.
To work around this, add a rule to the policy that allows the test
domains to inherit these descriptors from unconfined_service_t.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Kernels before 4.18.0-314.el8 lack the bugfix that is required for this
test to pass, so exclude it on these kernels.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
On RHEL-7.2, also the vsock_socket class is missing from the policy -
update the patch to v2, which also checks for the presence of the class.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
I missed that the new vsock_socket subtest fails to build on RHEL-7.
Apply a patch that excludes it when the necessary header/definition is
not available.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
CKI is running the testsuite also on clang-built kernels, which need the
modules to be built using clang, too. Apply pending patches from
upstream to make the testsuite work on these kernels.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
The capable_sys test is failing on F35 without his patch, because BTRFS
doesn't support the FIBMAP ioctl.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
...to allow switching the TCMS entry to refer directly here via a FMF
link. Note: I'm not adding the tags, as most of those is
RHEL/RH-specific and they can be maintained just in TCMS.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
It actually doesn't work (and doesn't get excluded automatically) on
RHEL-7 either, so change the condition to rhel < 9.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
The bugfix has been backported in RHEL-8.4, so we can now replace this
with a kernel version check, increasing the coverage on RHEL-8.4 and
above.
Verified that the testsuite still passes on RHEL-8.3, 8.4, and RHEL-9.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
The relevant config option is now enabled on RHEL-9, so we can skip it
on RHEL-8 only to get coverage on RHEL-9 and above.
Tested on latest RHEL-9 VM image.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Set AVC_ERROR=+no_avc_check in environment to disable restraint's
built-in AVC check so that it doesn't interpret the (expected) AVCs as
failure.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
It doesn't have a bugzilla, but better to have a regression test for it.
It's a very low-effort test, but still better than nothing :)
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
...to pull in two fixes for the userfaultfd test so it builds
sucessfully on RHEL-7 and remove the associated workaround from the
wrapper.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
This feature is required for proper support of virtiofs with SELinux.
Add a trivial test that verifies that this feature works via a dummy
SELinux module and ramfs mount.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
On RHEL-7 (and other old kernels), __NR_userfaultfd may not be defined
on some arches, so add a kernel version check for now to exclude
userfaultfd test when it would be skipped anyway.
I'll fix this more nicely in upstream, this is just a temporary solution
until that gets merged.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Highlights:
- fixed lockdown and perf_event tests to work with latest Fedora policy
- userfaultfd test added
- removed dependency on `which`
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
There are no s390x machines with enough cores to run this test in RH's
Beaker and likely won't be available in any CI system in the near
future. Thus, exclude the test from this arch so that testing doesn't
fail due to lack of matching hardware.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Since the testsuite now loads more policy modules, the `semodule -r
test_policy` command is not enough for a full cleanup. Do `make -C
policy unload instead`.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Based on several runs in Beaker, these seem to be the best conditions
for distinguishing the bug. Currently, legacy Beaker HW filters are used
in the metadata. Once TMT introduces support for generic HW
requirements, they will need to be converted to the new format.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
On fast systems with a lot of cores the 10s synflood run produces too
large perf.data (> 1 GiB), so reduce it to 5s and also increase the
test's time limit to 1h to make sure that it has enough time to process
such a large file.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
It turns out there is too much variability in the percent values across
arches/machines, so give up on the general approach (checking that all
SELinux functions are below some hard limit) and instead focus only on
selinux_peerlbl_enabled() and compare its position with other functions.
In case selinux_peerlbl_enabled() is not found in /proc/kallsyms, it is
inlined into other functions, so we need to check selinux_ip_postroute()
instead of selinux_peerlbl_enabled().
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
The file can get really huge and it compresses well, so it's better to
compress it with xz before doing rlFileSubmit.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
The generated perf.data can be quite big and uploading it takes a long
time in some cases, so raise the time to 20 minutes.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Rather than enumerating RHEL versions, use comparison against
"known-good" version to make the expressions easier to read and
understand.
Also convert users of '~<' to '<', as '~<' compares only minor versions
within the same major.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Relevancy changes are made based on recommendations from:
tmt test lint --fix
Some packages are available for Fedoras only and are not available
for RHELs at all.
Some packages are available for latest RHEL major versions only.
The main highlight is that filesystems tests are now run for all
supported filesystems, instead of just the one that is native to the
platform.
Also, the testsuite no longer (directly) requires Python, so drop the
dependency and a related workaround.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Fix compilation of SCTP test programs and disable SCTP ASCONF tests on
RHEL-8.1 kernels that don't have certain SCTP commits from upstream.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Put all the RHEL-specific checks/workarounds under one common rlIsRHEL
conditional to make it clear that they apply to RHEL.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
In the last upstream ref bump, I failed to notice that one of the new
commits causes the test to fail on RHEL-7 because of a missing interface
in the policy. Temporarily apply the patch I sent upstream to fix it.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Highlights:
- SCTP tests have been refactored and extended
- the "keys" subtest has been fixed to not fail when Intel QAT driver
is used for DH acceleration
- the GRE interface for a second IP address is now created
automatically by the testsuite
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
libselinux and selnux-policy are already required by their -devel
counterparts (and other packages), libsemanage is also not required
directly, and platform-python was only needed on earlier RHEL-8.0 dev
composes where python3 wasn't installable directly (and I suspect that
it wouldn't help there, anyway...).
Note that this also works around:
https://bugzilla.redhat.com/show_bug.cgi?id=1876847
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Add another global IPv4 address by creating a dummy GRE interface in
order to activate two extra SCTP tests that require two unique global
IPv4 addresses.
Before (F32):
Files=61, Tests=832, 176 wallclock secs ( 0.59 usr 0.13 sys + 4.92 cusr 6.54 csys = 12.18 CPU)
After (F32):
Files=61, Tests=834, 182 wallclock secs ( 0.66 usr 0.11 sys + 6.28 cusr 7.68 csys = 14.73 CPU)
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Recently there were some changes in CKI upstream kernel building and the
old bugginess detection doesn't work any more. Fix it to use adifferent
build program, which is still missing.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
An issue was found in CephFS that caused symlinks to be left unlabeled
upon creation. Extend the test to cover also symlinks, special file
types, and directories.
Upstream fix: https://marc.info/?l=ceph-devel&m=159596407215153&w=2
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Highlights:
- Use native filesystem for FS tests
- Avoid mmap test failures when /dev is mounted noexec
- Add nftables to inet_socket and sctp tests
- Fix overlayfs test false positive on new kernels (previously applied
as a patch)
- Add check for key changes on watch_queue
Several RHEL workarounds were needed, see the diff for details.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
When the boolean name passed to boolSet is an alias, then the current
implementation would always skip setting the boolean. That in turn
causes allow_domain_fd_use to remain unset when it is an alias and the
testsuite fails (because it then doesn't reset the value due to `make`
logic). That can cause AVCs in later tests and so needs to be fixed.
The fix is to just try `getsebool <name>` instead of grepping `getsebool
-a` for the boolean name.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
CKI interprets the "Abort" result as an infra failure and waives the
test in such case. So if "git clone" fails, it's better to abort the
whole test so that a false positive test failure is not reported.
Turns out that Beaker interprets the exit code 127 (possibly other ones,
but this one I'm sure about) as Abort, so we can just do that instead of
relying on the legacy rhts-abort command.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
